Date: Fri, 05 Jul 2013 20:22:02 -0700 From: Alan Coopersmith <alan.coopersmith@...cle.com> To: oss-security@...ts.openwall.com CC: Kurt Seifried <kseifried@...hat.com>, security@...e.de, Sebastian Krahmer <krahmer@...e.de> Subject: Re: Question about CVE for X!! DoS On 07/ 5/13 01:50 PM, Kurt Seifried wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > http://lists.opensuse.org/opensuse-updates/2013-07/msg00023.html > https://bugzilla.novell.com/show_bug.cgi?id=815583 > > Lists no CVE? I assume it needs one, or did upstream handle this? Upstream discussion, including reps from both Red Hat & SuSE, determined it didn't need a CVE, since it can only be triggered by a client authorized to connect to the Xserver (via xauth, xhost, etc.) and such a client, by design, can lock all other clients out from the server, kill clients, etc. It would be like wanting a CVE for the fact that another process running under your UID can kill your process. Not sure why SuSE decided to go ahead and release it as a security fix anyway - it's certainly a bug fix though. -- -Alan Coopersmith- alan.coopersmith@...cle.com Oracle Solaris Engineering - http://blogs.oracle.com/alanc
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.